diff options
| author | Max Krummenacher <max.krummenacher@toradex.com> | 2020-10-10 13:30:49 +0200 |
|---|---|---|
| committer | Max Krummenacher <max.krummenacher@toradex.com> | 2020-10-10 13:30:49 +0200 |
| commit | 566575659eec6b0a72de46dd1c3ae8fc221a90a5 (patch) | |
| tree | fed807b5725b3592752bb19005c9eea9dbcd387d /fs/ubifs | |
| parent | f1442a59da02a0b5ef648925f2f274a3e64999cc (diff) | |
| parent | 18f617d6f398c264e3172532a5d3c656f17cecfa (diff) | |
Merge tag 'v4.4.238' into toradex_vf_4.4-next
This is the 4.4.238 stable release
Signed-off-by: Max Krummenacher <max.krummenacher@toradex.com>
Diffstat (limited to 'fs/ubifs')
| -rw-r--r-- | fs/ubifs/io.c | 16 |
1 files changed, 14 insertions, 2 deletions
diff --git a/fs/ubifs/io.c b/fs/ubifs/io.c index 97be41215332..9213a9e046ae 100644 --- a/fs/ubifs/io.c +++ b/fs/ubifs/io.c @@ -237,7 +237,7 @@ int ubifs_is_mapped(const struct ubifs_info *c, int lnum) int ubifs_check_node(const struct ubifs_info *c, const void *buf, int lnum, int offs, int quiet, int must_chk_crc) { - int err = -EINVAL, type, node_len; + int err = -EINVAL, type, node_len, dump_node = 1; uint32_t crc, node_crc, magic; const struct ubifs_ch *ch = buf; @@ -290,10 +290,22 @@ int ubifs_check_node(const struct ubifs_info *c, const void *buf, int lnum, out_len: if (!quiet) ubifs_err(c, "bad node length %d", node_len); + if (type == UBIFS_DATA_NODE && node_len > UBIFS_DATA_NODE_SZ) + dump_node = 0; out: if (!quiet) { ubifs_err(c, "bad node at LEB %d:%d", lnum, offs); - ubifs_dump_node(c, buf); + if (dump_node) { + ubifs_dump_node(c, buf); + } else { + int safe_len = min3(node_len, c->leb_size - offs, + (int)UBIFS_MAX_DATA_NODE_SZ); + pr_err("\tprevent out-of-bounds memory access\n"); + pr_err("\ttruncated data node length %d\n", safe_len); + pr_err("\tcorrupted data node:\n"); + print_hex_dump(KERN_ERR, "\t", DUMP_PREFIX_OFFSET, 32, 1, + buf, safe_len, 0); + } dump_stack(); } return err; |